CVE-2016-9014

Advisory

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9014
• https://lists.fedoraproject.org/archives/list/[email protected]/message/QXDKJYHN74BWY3P7AR2UZDVJREQMRE6S/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/OG5ROMUPS6C7BXELD3TAUUH7OBYV56WQ/
• http://www.securitytracker.com/id/1037159
• http://www.ubuntu.com/usn/USN-3115-1
• https://www.djangoproject.com/weblog/2016/nov/01/security-releases/
• http://www.securityfocus.com/bid/94068
• http://www.debian.org/security/2017/dsa-3835